SDK - NTA 4.0 relative time query format

You can write use relative times in your query by starting with GETUTCDATE() and adding or subtracting days. So to query over the last 7 days, do this:

SELECT ...

FROM Orion.Netflow.Flows f

WHERE f.TimeStamp > GETUTCDATE() - 7 AND f.TimeStamp < GETUTCDATE()

GROUP BY ...

ORDER BY ...

To add or subtract hours, use fractional days. So "one hour ago" would be expressed as "GETUTCDATE() - 1/24"

Important note: the SWQL functions for doing date math (like ADDDAY, ADDHOUR, etc.) do work with flow data, but they aren't optimized. This means a several-orders-of-magnitude difference. Stick with + and - for doing date math when querying flow data.

(I also added this information to https://github.com/solarwinds/OrionSDK/wiki/NTA-4.0-Entity-Model.)

Hey, I appreciate you jumping on this so quickly as well as the wiki update.

No problem. And the wiki update is so I don't have to jump on it at all next time someone has this question.

Follow up if you'll allow me.

I'm trying to bar graph multiple time periods (30, 90, 180, 365 days) on the same graph. I am under the impression that there is no way to do this without a UNION ALL, as there is no way to assign multiple data sets to a chart. However, every attempt to do so is timing out but either query on its own is just fine. Is there a better way to do this beyond just exporting the data and graphing with a different tool? Can I adjust the timeout without causing any issue beyond more resources used while report is ran?

My code looks something like:

SELECT AVG(i.InPercentUtil) AS InAvg30

FROM i.Orion.NPM.InterfaceTraffic i

WHERE i.DateTime > GETUTCDATE() - 30

UNION ALL (same as but InAvg90 and GETUTCDATE() - 90)

Are you getting timeouts with this kind of query on InterfaceTraffic? Or is this still about Flow data?

Yeah, it's on interface traffic. Sorry if that wasn't clear. It's a different graph on the same report, but it's utilizing Orion.NPM.InterfaceTraffic now.

Yeah, it's on interface traffic. Sorry if that wasn't clear. It's a different graph on the same report, but it's utilizing Orion.NPM.InterfaceTraffic now.

It depends what kind of timeout you are getting. What's the actual error message?

In SWQL Studio I get "Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding."

Oh, I see - I thought you were in the Orion reporting interface. SWQL Studio does not have a way to extend the timeout. This query would be almost identical in SQL. You could just run it there.

edit: there is a way to extend SWQL Studio's 2-minute timeout. Edit C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwqlStudio.exe.config and find this piece around line 33:

      <setting name="OperationTimeout" serializeAs="String">

        <value>2</value>

      </setting>

And change the "2" to some higher value. It's in minutes. Restart SWQL Studio.